This vulnerability arises from hard-coded cryptographic keys embedded in the PropertyGuru AgentNet Singapore App's Android codebase (BuildConfig.java). The keys SEGMENT_ANDROID_WRITE_KEY and SEGMENT_TOS_WRITE_KEY are statically defined, which can allow an attacker with local access to potentially misuse these keys. The flaw affects multiple app versions from 23.7.0 through 23.7.10. The attack vector is local, requiring low privileges and no user interaction. The vendor has not issued any patch or official remediation, and no cloud service is involved.

The use of hard-coded cryptographic keys can weaken the security of cryptographic operations within the app, potentially allowing an attacker with local access to compromise confidentiality or integrity related to the affected keys. However, the attack requires local access and low privileges, limiting the scope of exploitation. There are no reported active exploits in the wild, and the overall impact is rated medium severity with a CVSS score of 4.8.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should minimize local access to devices running affected versions. Monitor for vendor updates or new advisories regarding this vulnerability. Avoid installing or using affected app versions if possible until a fix is released.